The National Vulnerability Database (NVD) crisis has been a long-standing issue, and the recent report by the US Department of Commerce Office of Inspector General (OIG) highlights the National Institute of Standards and Technology's (NIST) mismanagement of the situation. This crisis has far-reaching implications for cybersecurity, and it's time to take a closer look at the situation and the lessons we can learn from it.
The NVD Crisis: A Long-Standing Issue
The NVD was established in 2005 as a central repository for cybersecurity vulnerability data. When security researchers or software vendors discover a flaw, they submit a report through the Common Vulnerabilities and Exposures (CVE) program. NIST then takes this raw data and enriches it with additional analysis, including severity scores and information about affected product versions.
The enriched data is crucial for cybersecurity teams, as it helps them automate defenses, prioritize vulnerability fixes, and comply with federal requirements. However, the current crisis began in February 2024 when NIST's enrichment support contract lapsed, leaving the NVD program without adequate staffing.
The OIG report reveals that NIST had two years' notice of the need for a new contractor but failed to act in time. This resulted in a growing backlog of unprocessed vulnerabilities, with the situation worsening due to the Cybersecurity and Infrastructure Security Agency (CISA) not renewing financial support and the division overseeing the NVD being slow to request replacement funds.
By the end of 2025, the backlog had grown to over 27,000 vulnerabilities, and the OIG projects that the yearly total of reported vulnerabilities will surpass 60,000 in 2026, a nearly tenfold increase from a decade ago.
The Root Causes: Inefficiency and Mismanagement
The OIG identified four main problems in NIST's handling of the NVD crisis:
- Lack of Strategic Planning: NIST did not have a strategic plan for the NVD, which is a fundamental issue. Without a clear strategy, the program's direction and goals remain uncertain.
- Inefficient Enrichment Process: The enrichment process was found to be inefficient, with two tasks comprising most of the workload. One of these tasks, calculating severity scores, was deemed unnecessary, as nearly 80% of submissions already included scores from the submitting party, and CISA had been providing scores independently.
- Overlapping Enrichment Programs: NIST and CISA operate two overlapping vulnerability enrichment programs with little coordination. CISA's Vulnrichment program, launched in May 2024, further complicates the situation, as both agencies use the same government contractor and often complete the same tasks on the same vulnerabilities.
- Poor Communication: NIST's communication with NVD stakeholders is poor, and its official communications are lagging, which has contributed to the crisis.
The Way Forward: A Transformative Approach
To address the crisis, the OIG recommended several actions:
- Strategic Planning: NIST should create a comprehensive strategic plan for the NVD, outlining its goals and objectives.
- Backlog Management: Establish a clear backlog management plan with defined milestones to tackle the growing number of unprocessed vulnerabilities.
- Reducing Duplication: Eliminate duplicative severity scoring by relying on existing scores from CVE Numbering Authorities and CISA.
- Coordination with CISA: Improve coordination with CISA to eliminate overlapping work and ensure efficient use of resources.
- Stakeholder Engagement: Develop a proper stakeholder communication strategy to keep NVD users and contributors informed and engaged.
NIST has until July 25, 2026, to submit a formal action plan and implement these recommendations. The agency has also announced a new approach to populating and enriching the NVD, prioritizing critical vulnerabilities and relying on external sources for severity scores.
Conclusion: A Call for Urgent Action
The NVD crisis is a stark reminder of the importance of effective management and coordination in cybersecurity. The OIG's report highlights the need for NIST to take urgent action to address the backlog and improve the program's efficiency. Without significant changes, the NVD's credibility and reliability will continue to erode, impacting the entire cybersecurity ecosystem.
As an expert, I believe that this crisis presents a unique opportunity to transform the NVD and strengthen the nation's cybersecurity defenses. It is crucial to learn from this experience and implement the necessary changes to ensure a more robust and efficient system in the future.
